// Reference — updated 2026-08-21
The AI agent & MCP attack surface, mapped.
Every agent/MCP security technique, mitigation, and tool on this site, organized into the four layers where agentic systems actually break: the model, the tools, the memory, and the relationships between agents. 10 of 12 rows have a tool on this site that tests or fixes them directly — the rest are named honestly as open problems, not padded with a tool that doesn't really apply.
// The words in.
Model & context
Direct prompt injection and jailbreaks
OWASP LLM01, MITRE ATLAS
Test the system prompt against known injection categories before it ships — not after an incident surfaces the gap.
Indirect prompt injection via retrieved content
the webpage, PDF, or ticket the agent reads, not the user prompt
Treat every document, page, or file the agent retrieves as untrusted data — never as instructions — regardless of how authoritative the source looks.
Fragmented, mutually inconsistent context sources
context fragmentation, not model quality, is the common failure mode
Standardize how knowledge reaches the agent — a single, versioned, machine-parseable format beats N incompatible internal wikis and APIs.
// The actions out.
Tools & MCP
Excessive agency — over-broad tool permissions
OWASP LLM06
Scope every tool to the minimum it needs. Then test whether the agent can reach something it wasn't supposed to.
Malformed or adversarial tool-call arguments
tool arguments are sampled tokens, not guaranteed-valid input
Validate every tool call against its JSON Schema before execution. Malformed calls are a statistical certainty at scale, not an edge case.
Unauthenticated or over-disclosing MCP servers
server identity, exposed tools, and auth requirements are all discoverable pre-connection
Run the initialize handshake yourself before pointing an agent at a new MCP server, and check what it reveals unauthenticated.
MCP supply-chain exposure — unpinned versions, auto-install, mutable sources
standing authorizations in agent config are the durable version of this risk
Pin every MCP server version explicitly and audit config for auto-install flags and standing authorizations before they become someone else's supply-chain foothold.
Missing authorization checks on tool-reachable APIs (BOLA)
an agent found this class of bug in production, unprompted
Audit every API an agent can call for object-level ownership checks. An agent probing at scale will find a missing check faster than your next pentest cycle.
// The state that persists.
Memory
Memory poisoning — a durable foothold
Microsoft's agent threat taxonomy v2.0
Map every memory write path, audit what's already stored, and design the write path so poisoned entries expire and get caught rather than persisting silently.
// The relationships.
Orchestration & identity
Inter-agent trust escalation — no boundary between nodes
Microsoft's agent threat taxonomy v2.0 (confused-deputy, in natural language)
Enforce trust boundaries, shared-state isolation, per-node capability scoping, and blast-radius containment between agents — a compromised node should be an incident, not a takeover of the graph.
Static, long-lived credentials for agent-to-service auth
GitGuardian's 2026 State of Secrets Sprawl report
Migrate off static API keys to workload identity federation — short-lived OIDC tokens minted from the identity the agent's platform already has.
Secrets and instruction-like content leaking through agent config files
.mcp.json, .claude/settings.json, and the system prompt are plaintext on disk
Scan every agent config file for hardcoded secrets, over-broad permission flags, and instruction-shaped content sitting in data positions.
// Changelog
First published: four-layer matrix drawn from the site's 16 agentic-AI-security posts.